In Microsoft Windows NT®, remote clients can read and write to files across the network. The LanManager redirector (RDR) implements the client side of that protocol by converting NT file system requests into SMB protocol (recently renamed CIFS by Microsoft) requests. These requests are then sent to the particular LanManager fileserver for processing. Microsoft's srv.sys is a kernel level operating system component that implements the server side of this interface. As such, srv.sys is not a file system, but rather a fileserver. A system running srv.sys can allow remote users to access any local file system data stored on that particular system. There is a strong need in the software computing industry to filter or simulate the SMB (CIFS) traffic on a Windows NT host machine. Prior to the present invention, there were four technical solutions for doing so, each of which is described herein.
The Andrew File System (AFS), the popular distributed file system product from CMU and TransArch runs an SMB proxy server in user mode as a way to provide a different SMB (CIFS) server that co-exists with the actual Windows srv.sys. AFS is implemented as a SMB loop-back server that runs in user mode. By running in user-mode, AFS faced many challenges including securing fileserver data (fileserver metadata, the file data cache, etc.), performance degradation from running in user mode (as data had to be copied between user-mode address space and kernel-mode address space to satisfy every SMB request) and the inability to use the system standard buffer cache, which is managed by the NT kernel-mode cache manager (therefore, the same file buffer data could be located in two different buffer caches).
AFS also had to support different versions of the SMB protocol to be fully compatible with different Windows workstations that run different versions of the Windows operating system. Every Windows NT version comes with its own version of the SMB (CIFS) protocol (this is called the protocol dialect). This required continuous and intensive reverse engineering effort to explore the internals of the protocol. The AFS Windows implantation was not practical, and failed to meet the industry requirements because it lacked software security, system stability, system performance, platform compatibility and use of standard NT buffer cache. One attempt to improve the AFS approach was to run the SMB loop back server in kernel mode. This solved the performance and security problems, but did not solve the stability and platform compatibility problems.
Another approach involves building a file system filter driver that attaches to the local file system drivers running on the local system. Developing a file system filter driver for Windows is a very challenging task. The file system framework in Windows NT is very complicated and is not well documented by Microsoft. Thus, developing a file system filter driver requires an intensive amount of knowledge about the internals of the operating system and the behavior of different low-level system components.
Another drawback to building a file system filter driver is that all the local file system traffic is filtered whether it originated from local components running on the local host machine (such as a user mode process or kernel-mode device drivers that needs access to local file systems), or whether it is remote file access traffic that is coming from the network through the srv.sys driver. Filtering all the local file system activities introduces system performance regression.
Additionally, with this approach it challenging to identify which calls originated from srv.sys, because srv.sys queues all its requests, which are then served by a generic system worker thread. The context of the local thread is lost during this transition.
Thus, although the file system filter driver approach runs in kernel mode and utilizes the system buffer cache, it still has the following drawbacks: it is very hard to develop and maintain, it filters local traffic, it introduce an overall system performance regression, it is hard to identify the call context and it can affect system stability.
The Samba team started a project to develop a 5 MB server (like the AFS approach) that runs on a UNIX® host machine instead of running on a Windows NT machine. Samba has gained popularity in the network storage arena, especially for companies that are building new network storage architectures that requires a smooth integration with the Windows host machines. Despite its popularity, Samba still suffers from drawbacks. Samba runs in user space so it is performance and security are not as desired. Additionally, Samba's Windows platform compatibility is a problem, because Samba is another type of SMB emulator and not a native Windows solution.
What is needed are methods, systems and computer readable media for filtering the Windows NT fileserver (srv.sys) activities that avoid all the drawbacks mentioned above. Thus, the solution should run in kernel-mode, so as to avoid the security and performance drawbacks associated with user-mode solutions. The solution should not require developing a file system filter driver, should not filter all the local file system activities, should not affect the overall system performance and should not rely on the SMB (CIFS) protocol semantics.